ci(ci): group Dependabot updates and stop linting its own commits

[MarTrepodi]

Description

204d5d3 switched Dependabot from pip to uv, and it reached main. Dependabot then opened one PR per locked dependency (#175–#180), and every one fails Commit Lint:

build(deps-dev): Bump ruff from 0.15.15 to 0.17.0
✖ subject must not be sentence-case [subject-case]
⚠ scope must be one of [...] [scope-enum]

Why: dependabot-core copies casing from its last commit in the default branch's 100 most recent commits. main has none, so it falls back to a heuristic over human commits, which guessed build(deps-dev): Bump. The 18 earlier Dependabot commits on develop were all chore(deps): bump ….

 .github/dependabot.yml
   github-actions:
+    commit-message.prefix: "chore(deps)"
+    groups: github-actions = ["*"]
   uv:
+    commit-message.prefix: "chore(deps)"
+    groups:
+      astral-tools = ["ruff", "ty"]   # new diagnostics often need code fixes (see #175)
+      python       = ["*"]            # first match wins, so this stays last
 .github/workflows/commitlint.yml
   commits = PR-unique non-merge commits
+  if PR author == dependabot[bot]
+    drop commits authored by 49699333+dependabot[bot]@users.noreply.github.com

The pinned prefix fixes type/scope. It does not fix casing: capitalize_first_word? in dependabot-core ignores the configured prefix. So the lint skip is what actually unblocks these PRs. It's limited to Dependabot-opened PRs and Dependabot-authored commits, so a human commit pushed onto a Dependabot PR is still linted. Dependabot's commit bodies are a fixed template (Bumps…, updated-dependencies:), so the skip can't hide an accidental major-bump line (#174).

Timing: Dependabot reads dependabot.yml from main, so grouping and the prefix take effect only after the next release. The Commit Lint change applies to PRs into develop as soon as this merges.

Related Issues

Unblocks #175–#180. #175 also fails Type Check: ty 0.0.86 flags sorted() over a set that may contain None in helpers/_territory_battle.py. That needs a separate code fix.

Type of Change

• CI / build / dependencies

Checklist

• This PR targets the develop branch
• My commits follow the Conventional Commits / Angular convention
• I have not edited CHANGELOG.md by hand
• I have not bundled unrelated changes in this PR
• N/A: no src/ changes, so no unit tests / pytest / ty run

Testing

• The filter logic, run against build(deps-dev): Bump ruff from 0.15.15 to 0.17.0 #180's real head: Dependabot-only → nothing to lint ✔. A human fix(core): … commit stacked on top → only that commit is linted ✔.
• build(deps-dev): Bump ruff from 0.15.15 to 0.17.0 #180's message, run through commitlint locally, reproduces the subject-case ✖ and scope-enum ⚠ above.
• git merge-tree shows clean merges with ci(release): guard prepare-release against accidental major bumps #174 and ci(ci): pin commitlint once and run the same hook in CI #181 (ci(ci): pin commitlint once and run the same hook in CI #181 also edits commitlint.yml; the hunks don't overlap).
• Both YAML files parse.

Merge danger: two-way door. The blast radius is CI only: Dependabot's own commits stop being linted, and Dependabot PRs get batched once this reaches main.

🤖 Generated with Claude Code